Possible SYN flooding?

gbowden · 02-08-2007, 06:57 AM

I seem to be getting a few of these messages after upgrading to a 2.6.20 kernel and upgrading arno's firewall script.

Feb 8 12:51:56 gbnet kernel: possible SYN flooding on port 19516. Sending cookies.

Port 19516 is the port I use for Bittorrent.

Any ideas?

Regards,

Gregory Bowden

unSpawn · 02-08-2007, 07:39 AM

How many connections are we talking about ("netstat -ant | grep -c SYN_RECV")?
Does your firewall have any SYN checking in place (tcp --syn -> --limit-burst)?
Does the situation persist if you stop Bittorrent?
Does the situation persist if you (re)start Bittorrent with options like (or equiv to) --max_uploads, --max_initiate, --max_allow_in?

For background info here's the IETF Draft and a doc from Cisco (cuz it has pretty pictures). For more info see the LQ FAQ: Security references, post #2 "Netfilter, firewall, Iptables, Ipchains, DoS, DDoS".

gbowden · 02-08-2007, 08:01 AM

Running the netstat command I get the follwoing:

Code:

13:57:05 root@gbnet:~# netstat -ant | grep -c SYN_RECV
8

These are my iptables rules i'm using for Bittorrent:

Code:

# Put any custom (iptables) rules here down below:
##################################################
# Bittorent
iptables -I INPUT 1 -i eth0 -p tcp --tcp-flags SYN,RST,ACK SYN --dport 19516 -j ACCEPT
iptables -I INPUT 1 -i eth0 -p udp --dport 19517 -j ACCEPT
iptables -I INPUT 1 -i eth0 -p tcp --tcp-flags SYN,RST,ACK SYN --dport 6881 -j ACCEPT
iptables -I INPUT 1 -i eth0 -p udp --dport 6881 -j ACCEPT
iptables -I INPUT 1 -i eth0 -p tcp --tcp-flags SYN,RST,ACK SYN --dport 6346 -j ACCEPT
iptables -I INPUT 1 -i eth0 -p udp --dport 6346 -j ACCEPT
iptables -I INPUT 1 -i eth0 -p tcp --tcp-flags SYN,RST,ACK SYN --dport 60500 -j ACCEPT

When I stop running KTorrent the Bittorrent application these messages stop.

Regards,

Gregory Bowden

unSpawn · 02-08-2007, 08:15 AM

OK. Three answered, one to go.

gbowden · 02-08-2007, 08:32 AM

Dear unSpawn,

I'm using KTorrent to download torrents, so I don't really know what options correspond with the ones you posted.

But I have max uploads set to 10, 150 connections per torrent and 300 connections globally. I'm also limiting the upload speed to 15KB/sec and download to 100KB/sec.

unSpawn · 02-08-2007, 08:41 AM

Heh, I said "or equivalent". I don't know, *you* run that application so you have the docs.

gbowden · 02-08-2007, 08:49 AM

Ok I seem to have found the problem.
Once I deleted the torrent I thought was causing the problem the messages just stopped appearing.

Thanks for your help.

Regards,

Gregory Bowden

unSpawn · 02-08-2007, 09:16 AM

NP. You found the cause but I still have no idea why it did excessive SYN's. Could you post some specs about that particular torrent? Like what the tracker (s) it's on, does it do peerless as well, any clue that helps would be welcome. Else if you think sharing the .torrent could help, contact me by email and I'll have a look.